Many companies are now using role based access control (RBAC) to define and assign the access rights of the employees in the company's network. In RBAC the access rights are not assigned individually for each employee, but the access rights are based on a role that an employee plays within the enterprise. The role of an employee within a company is characterized by the job and/or the function he or she should perform in the organization. From an organizational point of view, these roles are independent of particular IT-systems and correspond to a predefined position or consist of one and/or more functions. Thus, the role structure can be derived from functional and organizational properties of the company.
With RBAC, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as engineer, manager, and human resources (HR) personnel). Access rights are grouped by role name, and the use of resources is restricted to individuals authorized to assume the associated role. For example, an HR employee may require full access to personnel records from which engineers should be restricted to preserve privacy, and engineers may require full access to technical design or product data from which HR employees should be restricted to preserve secrecy, while engineering managers require limited access to both types of data. Rather than set up (and maintain) each individual employee's access controls to the personnel and technical data, under RBAC, three roles may be defined: HR, engineer, and manager. All individuals in the organization who perform the associated role are grouped together, and access controls are assigned and maintained on a per-group basis.
The use of roles to control access can be an effective means for developing and enforcing enterprise-specific security policies, and for streamlining the security management process. User membership into roles can be revoked easily and new memberships established as job assignments dictate. New roles and their concomitant access privileges can be established when new operations are instituted, and old roles can be deleted as organizational functions change and evolve.
The current process of defining roles, often referred to as role engineering, is often based on a manual analysis of how an organization operates, and attempts to map that organizational structure to the organization's IT infrastructure. This process can require a substantial amount of time and resources, both for the analysis and implementation.
Other features of the present embodiments will be apparent from the accompanying drawings and from the detailed description that follows.